compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

Relevant Products/Components:

• trestle/core/commands/author/jinja.py

• trestle author jinja

Detailed Description:

The -o/--output argument in trestle author jinja allows writing files outside the intended workspace.

The application does not properly validate:

• ../

• ..\

• absolute paths

This allows arbitrary file write to attacker-controlled locations.

Vulnerable code:

output_file = trestle_root / r_output_file